Security firm Cyber-Ark has warned companies not to be complacent about the data they allow to flow over the internet, after the European Union announced an investigation into Google for retaining data from its search systems for too long.

The EU's Article 29 Data Protection Working Party, a group of officials that advises on privacy policy, asked Google last week to justify the retention of data on its users' internet searches for up to two years.

Google's recent decision to cut the time it keeps user data on web searches to between 18 and 24 months still does not seem to meet EU data protection rules.

Calum Macleod, European director at Cyber-Ark, said that, while the EU's investigation is laudable, the global nature of the internet makes it impossible to know exactly where and for how long data is being archived.

"As in Europe, US corporations are closely controlled as to what they do with personal and private data, but elsewhere in the world, notably Asia and the Far East, there are far fewer controls," he said.

"Companies that use the internet for their communications need to take great care when transmitting company data across the internet, whether via regular email or FTP technology.

"Commercially sensitive information can often end up where it should not and, perhaps worse, even be accessible to smart searches using Google."